Entanglement as precondition for secure quantum key distribution 
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We demonstrate that a necessary precondition for unconditionally secure quantum key distribu- 
tion is that sender and receiver can use the available measurement results to prove the presence 
of entanglement in a quantum state that is effectively distributed between them. One can thus 
systematically search for entanglement using the class of entanglement witness operators that can 
be constructed from the observed data. We apply such analysis to two well-known quantum key 
distribution protocols, namely the 4-state protocol and the 6-state protocol. As a special case, we 
show that, for some asymmetric error patterns, the presence of entanglement can be proven even 
for error rates above 25% (4-state protocol) and 33% (6-state protocol). 
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Quantum key distribution (QKD) allows two par- 
ties (Alice and Bob) to generate a secret key despite the 
computational and technological power of an eavesdrop- 
per (Eve), who interfers with the signals. Together with 
the Vernam cipher ,3], QKD can be used for uncondi- 
tionally secure communication. 

QKD protocols distinguish typically two phases to es- 
tablish a key. In the first phase, an effective bi-partite 
quantum mechanical state is distributed between the le- 
gitimate users, which establishes correlations between 
them. A (restricted) set of measurements is used to mea- 
sure these correlations, and the measurement results are 
described by a joint probability distribution P{A, B). In 
the second phase, called key distillation, Alice and Bob 
use an authenticated public channel to process the corre- 
lated data in order to obtain a secret key. This procedure 
involves, typically, postselection of data, error correction 
to reconcile the data, and privacy amplification to decou- 
ple the data from a possible eavesdropper j3| • 

In this Letter we consider the first phase of QKD and 
demonstrate that a necessary precondition for success- 
ful key distillation is that Alice and Bob can detect the 
presence of entanglement in a quantum state that is ef- 
fectively distributed between them. Such detection may 
involve available observed data only; it can be realized 
by using the class of entanglement witness operators that 
can be constructed from these data. 

Two types of schemes are typically used to create corre- 
lated data. In prepare&measure schemes (P&M schemes) 
Alice prepares a random sequence of pre-defined non- 
orthogonal states that are sent to Bob through an un- 
trusted channel (controlled by Eve). Generalizing the 
ideas of Bennett et al. [3, the signal preparation can 
be thought of as follows: Alice prepares an entangled bi- 
partite state of the form \^ source) ab = '}2iy/Pi\^i)\'Pi) ■ 
If she measures the first system in the canonical or- 
thonormal basis \ei), she effectively prepares the (non- 
orthogonal) signal states \Lpi) with probabilites pi. The 
action of the quantum channel on the state \^ source) ab 



leads to an effective bi-partite state shared by Alice and 
Bob. One important characteristic of the P&M schemes 
is that the reduced density matrix pA of Alice is fixed 
[q]. In entanglement based schemes a bi-partite state is 
distributed to Alice and Bob by an, in general, untrusted 
third party. This party may be an eavesdropper who is in 
possession of a third sub-system that may be entangled 
with those given to Alice and Bob. While the subsys- 
tems measured by Alice and Bob result in correlations 
described by P{A, B), Eve can use her subsystem to ob- 
tain information about the data of the legitimate users. 
Entanglement based schemes have been introduced by 
Ekert p] , who proposed to detect the presence of corre- 
lations of quantum mechanical nature by looking at pos- 
sible violations of Bell-like inequalities. This is, in gen- 
eral, more restrictive than detection of the presence of 
entanglement. As we will show below, the success of the 
key distillation phase requires that the performed mea- 
surements together with P{A, B) suffice to prove that the 
(effective) bi-partite state is entangled. 

The starting point for our considerations is an upper 
bound for the distillation rate of a secure key from the 
correlated data via public communication, which is given 
by the intrinsic information I {A; B [ E), introduced by 
Maurer Consider all possible tri-partite states that 
Eve can establish using her eavesdropping method, and 
all measurements she could perform on her sub-system. 
This gives rise to a set of possible extension V of the ob- 
servable probability distribution P{A,B) to P{A, B, E). 
Maurer Q defines I{A; B I E) using the mutual informa- 
tion I{A;B\E) between Alice and Bob given the public 
announcement of Eve's data, as described by the condi- 
tional probabilites P{A, B\E). In an adaptation of Mau- 
rer's work we define the intrinsic information as 

I{A;B i E) ^Mv IiA;B\E) . (1) 

An important consequence is that whenever the ob- 
servable data P{A, B) can be explained as coming from 
a tripartite state with a separable reduced density matrix 
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for Alice and Bob, the intrinsic information vanishes. 

Observation 1 Assume that the observable joint prob- 
ability distribution P{A, B) together with the knowledge 
of the corresponding measurements can be interpreted as 
coming from a separable state gab- Then the intrinsic 
information vanishes and no secret key can be distilled 
via public communication from the correlated data. 

This is easy to see for entanglement based schemes as 
we extend a separable reduced density matrix uab ~ 
Y,i1i\'Pi)A{'Pi\ ® to a tripartite pure state of 

the form l^'sep) = Y.i^/^\^i)A\'^i)B\ei)E- Here \ei)E 
is a set of orthonormal vectors spanning a Hilbert space 
of sufficient dimension. If Eve measures her sub-system 
in the corresponding basis, the conditional probability 
distribution conditioned on her measurement result fac- 
torizes so that for this measurement I{A]B\E) = 0. As 
a consequence, the intrinisic information vanishes and 
no secret key can be distilled. In the case of P&M 
schemes we need to show additionally that the state 
l^sep) can be obtained by Eve by interaction with Bob's 
system only. In the Schmidt decomposition \^ source) can 
be written as \^ source) = Y.i'^iWi) A\vi) b- Then the 
Schmidt decomposition of l^'sep), with respect of sys- 
tem A and the composite system BE, is of the form 
|*sep) = I]i Ci\ui)A\ei)BE sincc a and \ui)A are fixed by 
the known reduced density matrix pA to the correspond- 
ing values of \^ source)- Then one can find a suitable 
unitary operator Ube such that \ei)BE = UBE\vi) b\^) e 
where 10)^; is an initial state of an auxiliary system. 

In both types of schemes it is clear that we can obtain 
a secret key whenever the distributed (or effectively dis- 
tributed) bi-partite states are entangled qubit states and 
we are allowed to perform joint quantum manipulations 
on these states. This is true since one can distill maxi- 
mally entangled states in this situation However, 
up to now it is not clear whether this is still true if Al- 
ice and Bob perform their respective measurements and 
can perform only classical operations on their correlated 
data. This scenario has been partially addressed under 
extra assumptions in [ill Il3| . More recently, Acin et 
al. Q proved that one can always distill a secret key 
from any bi-partite entangled qubit states by adapting 
the local measurements to the quantum state and per- 
forming subsequently a classical protocol. 

Let us now turn to the investigation of the correla- 
tions in detail. The question whether the effectively dis- 
tributed bi-partite state is entangled can be addressed 
based on the ideas of entanglement witnesses. An entan- 
glement witness is an observable that detects the pres- 
ence of entanglement (if any) of a given state p: A state 
p is entangled iff there exist a hermitian witness opera- 
tor W such that Tr(VFp) < 0, while we have Tr(W^cr) > 
for all separable states a. These operators, as any bi- 
partite hermitian operator, can always be decomposed 
into a pseudo-mixture of projectors onto product vectors 



W = Ci \ai){ai\ ® \bi) where the coefficients q are 
real numbers and fulfill Ci = 1 0,0,^- Given such 
a decomposition of W, the expectation value Tr{Wp) can 
be obtained directly from the expectation value, P{ai, bi). 

In our approach we consider the reverse problem: 
Given a particular set of local measurements performed 
by Alice and Bob, and search for all entanglement wit- 
nesses that can be constructed from them. 

Theorem 1 Given a set of local operations with POVM 
elements Fa ® Gb together with the probability distribu- 
tion of their occurrence, P{A,B), then the correlations 
P{A, B) cannot lead to a secret key via public commu- 
nication unless one can prove the presence of entangle- 
ment in the (effectively) distributed state via an entan- 
glement witness W ~ ^ Ca,bFa ® Gb with Ca,b real 
such that TiiyVa) > for all separable states a and 

Ea,b^a,bPia,b) <0. 

By observation 1 it is a necessary condition for the 
success of the key distillation phase that we can exclude 
separable quantum states as the origin of the observed 
correlations of the first phase. The observed data define 
equivalence classes of reduced density matrices that are 
compatible with the data. We need to distinguish be- 
tween cases where the determined equivalence class con- 
tains separable states and those that do not. For this 
we proceed as follows: Note that the operators of the 
form J2a b '^a,bFa Gb form a real vector space which is 
a sub-space of the vector space spanned by the hermi- 
tian operator basis of the composite Hilbert space. The 
separable density matrices form a compact, convex set 
in that vector space, and its projection into a sub-space 
is again a compact and convex set formed by elements 
that represent the equivalence classes mentioned before. 
Each element of this new set can be explained as being 
the projection of a separable density matrix, while the el- 
ements of the complement of the set cannot be explained 
in this way and must therefore come from the projection 
of an entangled state. In the subspace, we therefore need 
to distinguish a compact and convex set form its comple- 
ment, which is done, again, by witness operators. In the 
sub-space, all witnesses operators can be realized by defi- 
nition. The corresponding operators on the larger vector 
space are those witness operators that can be created by 
real linear combinations of the local measurements. This 
proves the theorem. 

The question whether certain correlations are of quan- 
tum origin and might lead to a secure key is therefore 
reduced to a search over all entanglement witnesses that 
can be constructed from the protocol and the collected 
data. We will illustrate the consequences of this view for 
well-known protocols, namely the 6-state protocol 
and the 4-state protocol • In searching through the en- 
tanglement witnesses, note that some conditions derived 
from witnesses are redundant in the sense that all en- 
tangled states detected by one witness can be contained 
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in the set of detected entangled states of another wit- 
ness. A witness operator W is caUed optimal if no 
other entanglement witness exists that detects all states 
detected by W. The class of optimal entanglement wit- 
nesses for two qubit states, denoted by OEW, are given 
hyW = |0e) (</'e|"^^ 113) where |0e) denotes an entangled 
state and Tp is the partial trace, that is, the transposi- 
tion with respect to one subsystem. 

For the case of the 6-state protocol, Alice and Bob 
perform projection measurements onto the eigenstates of 
the three Pauli operators ax,cTy, and Cz in the entan- 
glement based scheme where Eve distributes bi-partite 
qubit states. In the corresponding P&M scheme, Alice 
prepares the eigenstates of those operators by performing 
the same measurements on a maximally entangled qubit 
state. Therefore, the set of three measurement bases used 
in the protocol allows Alice and Bob to construct any en- 
tanglement witness of the form 

c,j(T,(g>aj, (2) 

i,j={0,x,y,z} 

where ao — H and Cij are real numbers. Note that the 
set of operators {<7i(^<7j}ij constitutes an operator basis 
in (g) C^. Therefore Alice and Bob can evaluate all 
entanglement witnesses, in particular the class OEW of 
optimal witnesses for two qubits, as given above. This 
means that in this protocol all entangled states can be 
detected. Alternatively to the witness approach, Alice 
and Bob can employ quantum state tomography tech- 
niques in connection with the Peres-Horodecki criterion 

Qui. 

While the analysis of the 6-state protocol is quite sim- 
ple, the 4-state protocol, however, needs a deeper exam- 
ination since it turns out that the optimal witnesses in 
OEW cannot be evaluated with the given correlations, 
as we will see below. In the four state protocol Alice 
and Bob perform projection measurements in two qubit 
bases, say x and z. In the corresponding P&M scheme 
Alice uses the same set of measurements on a maximally 
entangled state. 

For the entanglement scheme we obtain the set of en- 
tanglement witnesses that can be evaluated with the re- 
sulting correlations as 

W = Cij (Ji ® (Jj . (3) 

This class, which we shall denote as EW4, can be char- 
acterized with the following observation. 

Observation 2 Given an entanglement witness W we 
find W e EWi iffW = W'^ = W'^p . 

To see this, we start with the general ansatz of Eqn. (O 
and impose the conditions W = W'^ = W^^ . This di- 
rectly constraints W to the form (|3Jl since ay is the only 



skew-symmetric element in the operator basis. The re- 
verse direction is then trivial. 

Note that that the elements of OEW, W = \(t)e){<i)eV'' , 
are nonpositive, while W'^^ = \(j)e){(l>e\ is a positive op- 
erator for all entangled states \4>e)- This means that, in 
contrast to the case of the 6-state protocol, the 4-state 
protocol does not allow to evaluate the optimal witnesses 
in OEW. As a result, there can be entangled states that 
give rise to correlations P{A^ B) that are not sufficient to 
prove the presence of entanglement. 

The concept of optimal witnesses can be extended by 
calling a witness W optimal in class C iff there is no other 
element in C that detects all entangled states detected 
by W. Our basic goal is now to characterise a family 
of witness operators that are optimal in class EW4, such 
that it is sufficient to check this family of witnesses to de- 
cide whether the presence of entanglement can be verified 
from the given data. 

For this purpose we present a necessary condition for 
a bi-partite state to contain entanglement that can be 
detected by elements of EW4. 

Observation 3 Given W G EW4, a necessary condition 
to detect entanglement in state p is that the operator — 
J (^p + p^^ + p"^^ -|- p'^) is a non-positive operator. 

To see this, let us start by the observation that the sym- 
metries of the witness operators in EW4 give rise to the 
identity {W p) = Tr(PFri). Now let us assume that 
the operator is non-negative. Then one can interpret 
it as a density matrix. Since it is invariant under partial 
transposition, it must be a separable state. Since W is 
a witness operator, we must therefore find Tr [W p) > 0. 
As a result, we find that the non-positivity of O is a nec- 
essary condition to detect entanglement of the state p 
with witnesses in EW4. 

Theorem 2 Gonsider the family of operators W — 
^{Q + Q"^'')} where Q — \<j)e){<j>e\ o,nd denotes a real 
entangled state. The elements of this family are witness 
operators that are optimal in EW4 and detect all the en- 
tangled .states that can be detected within EW4. 

Let us start by checking that this family, indeed, 
can detect all entanglement that can be detected in 
EW4. From the observation 01 we know that we 
need only to consider bi-partite states p„ such that 

^ri = J {Pn + Pn'^ + Pn"" + Pn) IS UOn-pOSitivC. Wc 

can find, therefore, an (entangled) state |0„) such that 
((/)„|ri„|0„) < 0. Moreover, since S7„ = fi^, this operator 
has a real representation. In this representation, also the 
state |(/)„) has a real representation '23"|. Let us definine 
the projector Q = \(t'n){4'7i\- Then we find (0„|ri„|(/)„) = 
Tr (i (Q + Q^-* + + Q'^) p). Therefore, we can de- 
fine the operator W = I {Q -\- -\- Q^^ + Q^) that 
can be further simplified to = -j (Q + Q^^ ) thanks 
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to the real representation of Q. This operator is a wit- 
ness operator, since Tr [Wa) > for all separable states 
a, while Ti-{Wpn) < for the chosen p„. Moreover, by 
construction the faniiliy of these witness operators detect 
all entanglement that can be detected within EW4. The 
prove of optimality is omitted here. H 

The set of witness operators W = ^{Q + Q^^), with 
Q = \(f>e){4'e\, provides an infinite number of necessary 
and sufficient conditions for the presence of entangle- 
ment in the observable correlations P{A,B). Each con- 
dition is characterized by a real entangled state |(/'e), and 
therefore the coefficients of the pseudo-mixture decom- 
position of the corresponding witness operators can be 
easily parametrized with three real parameters. ^From a 
practical point of view, this means that Alice and Bob 
can easily check this set of conditions numerically. 

Let us briefly analyze the implications of our results 
in the relationship between the bit error rate e in the 
protocols and the presence of correlations of quantum 
mechanical nature. Here error rate refers to the sifted 
key, that is, those events where signal preparation and 
detection employ the same polarization basis. An inter- 
cept/resend attack breaks the entanglement and gives 
rise to e > 25% (4-state protocol) and e > 33% (6- 
state protocol), respectively [TslE^ . This means that if 
the error rate is below these values, this already sufficies 
to prove that the joint probability distribution P{A, B) 
contains quantum mechanical correlations. However, for 
some asymmetric error patterns, it is possible to detect 
the presence of quantum correlations even for error rates 
above 25% (33%). Let us illustrated this fact with an ex- 
ample that is motivated by the propagation of the polar- 
ization state of a single photon in an optical fiber. This 
channel can be described by a unitary transformation 
that changes on a timescale much longer than the repe- 
tition cycle of the signal source, so it can be thought to 
be constant over that time. Consider the unitary trans- 
formation U{0) — cos 6*1 — isiwOay. In this scenario, 
the resulting bit error rate is given by e = sin'^ 6 and 
e = I sin^ 9 for the 4-state and the 6-state protocols, 
respectively. Nevertheless, in both cases the existence 
of quantum correlations can be detected for all angles 
9. The case of the 6-state protocol is clear, since a uni- 
tary transformation preserves the entanglement and all 
entanglement can be verified in this protocol. With re- 
spect to the 4-state protocol, it can also be shown that 
there is always an entanglement witness W £ EW4 that 
detects quantum correlations in P{A,B). In particu- 
lar, if we select We = \{\4)e){(t>e\ + |0e)(0er''), with 
\(j)e) the eigenvector of the operator (|?/;) = 

cos^lOO) + sin6'|01) - sin6'|10) + cos6'|ll)) which corre- 
sponds to its negative eigenvalue, then we find in a suit- 
able representation as a pseudo-mixture for the entangle- 
ment witness that Tr(We/9) = '^i P{(^ii^i) — 

To conclude, we have as a necessary condition for QKD 
that the legitimate users can prove the presence of entan- 



glement in the effectively distributed quantum state. In 
order to construct practical and efficient new QKD pro- 
tocols, it is vital to separate the generation of two-party 
correlations from the public discussion protocol which 
extracts a key from those data. We have analyzed the 
4-state and 6-state QKD protocols, and we have derived 
necessary and sufficient conditions for the existence of 
quantum correlations in both protocols. As a special 
case, we have demonstrated that, for some asymmetric 
error patterns, the presence of this type of correlations 
can be detected even for error rates above 25% and 33%, 
respectively. 
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